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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 



Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .1 36(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment See 37 CFR 1.704(b). 

Status 

1 )M Responsive to communication(s) filed on 02 July 2004 . 
2a)E3 This action is FINAL. 2b)D This action is non-final. 

3) Q Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-24 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) IS Claim(s) 1^24 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) Q The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2. Q Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 



Attachments) 

1 ) □ Notice of References Cited (PTO-892) 4) □ Interview Summary (PTO-41 3) 

2) □ Notice of Draftsperson's Patent Drawing Review (PTO-948) Paper No(s)/Mail Date. . 

3) Q Information Disclosure Statement(s) (PTO-1449 or PTO/SB/08) 5 ) Q Notice of Informal Patent Application (PTO-152) 

Paper No(s)/Mail Date . 6) □ Other: . 
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DETAILED ACTION 

STATUS 

Claims 1-24 have been examined. 

TfflS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 . 1 36(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

Response to Arguments 

The Applicants arguments filed on July 7, 2004 have been fully considered. 

The Applicant states that claims previously rejected under 35 USC 101 are patentable 
subject matter. 

The Examiner responds that as an initial matter, the United States Constitution under Art. 
I, §8, cl. 8 gave Congress the power to n [p]romote the progress of science and useful arts, by 
securing for limited times to authors and inventors the exclusive right to their respective writings 
and discoveries". In carrying out this power, Congress authorized under 35 U.S.C. §101 a grant 
of a patent to "[w]hoever invents or discovers any new and useful process, machine, 
manufacture, or composition or matter, or any new and useful improvement thereof/' Therefore, 
a fundamental premise is that a patent is a statutorily created vehicle for Congress to confer an 
exclusive right to the inventors for "inventions" that promote the progress of "science and the 
useful arts". The phrase "technological arts" has been created and used by the courts to offer 
another view of the term "useful arts". See In re Musgrave, 167 USPQ (BNA) 280 (CCPA 
1970). Hence, the first test of whether an invention is eligible for a patent is to determine if the 
invention is within the "technological arts". 

Further, despite the express language of §101, several judicially created exceptions have 
been established to exclude certain subject matter as being patentable subject matter covered by 
§101. These exceptions include "laws of nature", "natural phenomena", and "abstract ideas". 
See Diamond v. Diehr, 450, U.S. 175, 185, 209 USPQ (BNA) 1, 7 (1981). However, courts have 
found that even if an invention incorporates abstract ideas, such as mathematical algorithms, the 
invention may nevertheless be statutory subject matter if the invention as a whole produces a 
"useful, concrete and tangible result." See State Street Bank & Trust Co. v. Signature Financial 
Group, Inc. 149 F.3d 1368, 1973, 47 USPQ2d (BNA) 1596 (Fed. Cir. 1998). 
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This "two prong" test was evident when the Court of Customs and Patent Appeals 
(CCPA) decided an appeal from the Board of Patent Appeals and Interferences (BPAI). See In 
re Toma, 197 USPQ (BNA) 852 (CCPA 1978). In Toma, the court held that the recited 
mathematical algorithm did not render the claim as a whole non-statutory using the Freeman- 
Walter-Abele test as applied to Gottschalk v. Benson, 409 U.S. 63, 175 USPQ (BNA) 673 
(1972). Additionally, the court decided separately on the issue of the "technological arts". The 
court developed a "technological arts" analysis: 

The "technological" or "useful" arts inquiry must focus on whether the 
claimed subject matter... is statutory, not on whether the product of the claimed 
subject matter... is statutory, not on whether the prior art which the claimed subject 
matter purports to replace.. .is statutory, and not on whether the claimed subject 
matter is presently perceived to be an improvement over the prior art, e.g., 
whether it "enhances" the operation of a machine. In re Toma at 857. 

In Toma, the claimed invention was a computer program for translating a source human language 
(e.g., Russian) into a target human language (e.g., English). The court found that the claimed 
computer implemented process was within the "technological art" because the claimed invention 
was an operation being performed by a computer within a computer. 

The decision in State Street Bank & Trust Co. v. Signature Financial Group, Inc. never 
addressed this prong of the test. In State Street Bank & Trust Co., the court found that the 
"mathematical exception" using the Freeman- Walter-Abele test has little, if any, application to 
determining the presence of statutory subject matter but rather, statutory subject matter should be 
based on whether the operation produces a "useful, concrete and tangible result". See State Street 
Bank & Trust Co. at 1374. Furthermore, the court found that there was no "business method 
exception" since the court decisions that purported to create such exceptions were based on 
novelty or lack of enablement issues and not on statutory grounds. Therefore, the court held that 
"[wjhether the patent's claims are too broad to be patentable is not to be judged under §101, but 
rather under §§102, 103 and 112." See State Street Bank & Trust Co. at 1377. Both of these 
analysis goes towards whether the claimed invention is non-statutory because of the presence of 
an abstract idea. Indeed, State Street abolished the Freeman- Walter-Abele test used in Toma. 
However, State Street never addressed the second part of the analysis, i.e., the "technological 
arts" test established in Toma because the invention in State Street (i.e., a computerized system 
for determining the year-end income, expense, and capital gain or loss for the portfolio) was 
already determined to be within the technological arts under the Toma test. This dichotomy has 
been recently acknowledged by the Board of Patent Appeals and Interferences (BPAI) in 
affirming a §101 rejection finding the claimed invention to be non-statutory. See Ex parte 
Bowman, 61 USPQ2d (BNA) 1669 (BdPatApp&Int 2001). 

In the present application claims 1 and 12 only recites an abstract idea. In claims 1 and 
12 the applicant claims a method for creating policy groups, moving a data element between 
groups and generating a privacy policy based upon the policy group. This process might be 
performed without the aid of any technology and therefore the claimed method is not within the 
technological arts. 
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The Applicant states that the claims of the present invention are directed towards a 
different purpose and are not obvious in view of the prior art. 

Examiner responds that as per Ex parte Clapp, 227 USPQ 972 (Bd Pat App & Int) "To 
support conclusion that claimed combination is directed to obvious subject matter, the references 
must either expressly or impliedly suggest claimed combination or the examiner must present a 
convincing line of reasoning as to why artisan would have found claimed invention to have been 
obvious in light of the references teachings.", the Examiner states the reference deals with the 
generalized problem of creating privacy policies and therefore would be obvious to a person of 
ordinary skill in the art. 

The applicant states that the Moriconi et al refernce does not address the problem of 
creating a "privacy policy" 

The Examiner responds that Moriconi et al states "It is the further object of the present 
invention to provide a system that combines a centrally managed policy database with distributed 
authorization (access control) services that enforce the policy for all applicationsacross the 
organization" (Column 3 ,lines 63-67), while the Examiner notes the difference between 
"security" and "privacy" it is also noted that a system that enforces an authorization policy by 
definition is also enforcing a privacy policy. Therefore by establishing a hierarchy of 
permissions to access data Moriconi et al in effect creates a privacy policy. 
See following rejection. 

Claim Rejections - 35 USC §101 
35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or 
any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 

Claims 1 and 12 are rejected under 35 U.S.C. 101 because the claimed invention is 
directed to non-statutory subject matter. In claims 1 and 12 the applicant claims a method for 
creating policy groups, moving a data element between groups and generating a privacy policy 
based upon the policy group. This process might be performed without the aid of any 
technology and therefore the claimed method is not within the technological arts. 

All that is necessary to make a sequence of operational steps in a statutory process within 
35 U.S.C. 101 is that it be in the technological arts so as to be in concordance with the 
Constitutional purpose to promote the progress of "useful arts" In re Musgrave, 431 F.2d 882 
167 USPQ 280 (CCPA 1970) 

A claim is limited to a practical application when the method, as claimed, produces a 
concrete, tangible and useful result: i.e. the method recites a step or act of producing something 
that is concrete, tangible and useful. See AT&T v. Excel Communications Inc., 172 F3d at 1358, 
50 USPQ2dat 1452. 

Claims 2-11 and 13-22 are dependant on rejected claim 1 and 12 respectively , and are 
rejected for at least the same reasons. 
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Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

Claims 1- 24 are rejected under 35 U.S.C. 103(a) as being unpatentable over Moriconi et 
al (US Patent 6,158,010) in view of Abraham et al. (WO 98/40987). 

As per claim 1, 

Moriconi et al ('010) discloses a method for creating a privacy policy, comprising: 

moving a data element to the policy group;(Figure 9) 

generating a privacy policy based on the policy group. (Figure 4) 

Moriconi et al ('010) does not explicitly disclose creating a policy group, Abraham et al. 
('987) discloses creating a policy group.(Abstract) It would have been obvious to one having 
ordinary skill in the art at the time the invention was made to combine the Moriconi et al ('010)'s 
method with the Abraham et al. ('987)'s method in order to secure management of a computer 
network 

As per claim 2, 

Moriconi et al ('010) discloses the method of claim 1, 

wherein the data element is a predefined data element. (Column 6, lines 20-26) 
As per claim 3, 

Moriconi et al ('010) discloses the method of claim 1, 

wherein the data element comprises at least one sub-element. (Column 6, lines 46-51) 
As per claim 4, 

Moriconi et al ('010) discloses the method of claim 1, further comprising: 
updating a policy-wide property; and generating the privacy policy based on the policy- 
wide property.(Column 5, lines 48-55) 

As per claim 5, 

Moriconi et al ('010) discloses the method of claim 1, 

wherein the step of generating a privacy policy comprises generating a human readable 
version of the policy.(Column 9, lines 45-50 - Examiner notes that although Moriconi et al does 
not specifically disclose "generating a human readable version of the policy" it would be obvious 
that if the policy is manipulated via a GUI it would be readable to the user.) 
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As per claim 6, 

Moriconi et al ( e 010) discloses the method of claim 5 5 

Official Notice is taken that "hypertext markup language version of the policy" is 
common and well known in prior art in reference to policy management. It would have been 
obvious to one having ordinary skill in the art at the time the invention was made to render the 
policy in HTML format in order to provide a format that is universally viewable across a wide 
variety of computer platforms and operating systems. 

As per claim 7, 

Moriconi et al ('010) discloses the method of claim 1, 

Official Notice is taken that "generating an extensible markup language version of the 
policy" is common and well known in prior art in reference to policy management. It would 
have been obvious to one having ordinary skill in the art at the time the invention was made to 
render the policy in XML format in order to provide a format that is universally viewable across 
a wide variety of computer platforms and operating systems. 

As per claim 8, 

Moriconi et al ('010) discloses the method of claim 1, 

wherein the step of generating a privacy policy comprises generating a compact 
policy.(Figure 4 - note element 436 optimizer) 

As per claim 9, 

Moriconi et al ('010) discloses the method of claim 1, 

wherein the step of generating a privacy policy comprises generating a policy statement 
corresponding to the policy group.(Figure 4) 

As per claim 10, 

Moriconi et al ('010) discloses the method of claim 9, 

wherein the step of generating a privacy policy further comprises generating a table of 
policy elements, wherein a policy element in the table of policy elements corresponds to the 
policy statement.(Column 4, lines 34-37 — the rules [i.e. elements] are stored in a database [i.e. 
table]) 

As per claim 11, 

Moriconi et al ('010) discloses the method of claim 1, further comprising: 
identifying an error in the privacy policy ;(Column 1 1, lines 44-46 - Although Moricini 
does not specifically disclose generating an error statement describing the error he does disclose 
generating a log file, it is well known within modern computing systems to automate the 
generation of error reports from log files) 

As per claim 12, 

Moriconi et al ('010) discloses an apparatus for creating a privacy policy, comprising: 
movement means for moving a data element to the policy group;(Figure 9) 
generation means for generating a privacy policy based on the policy group. (Figure 4) 



* • 
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Moriconi et al ('010) does not explicitly disclose creation means for creating a policy 
group, Abraham et al. ( fi 987) discloses creation means for creating a policy group. (Abstract) It 
would have been obvious to one having ordinary skill in the art at the time the invention was 
made to combine the Moriconi et al ('OlO)'s apparatus with the Abraham et al. ('987)'s 
apparatus in order to secure management of a computer network 

As per claim 13, 

Moriconi et al ('010) discloses the apparatus of claim 12, 

wherein the data element is a predefined data element. (Column 6, lines 20-26) 

As per claim 14, 

Moriconi et al ('010) discloses the the apparatus of claim 12, 

wherein the data element comprises at least one sub-element. (Column 6, lines 46-51) 
As per claim 15, 

Moriconi et al ('010) discloses the apparatus of claim 12, further comprising: 
means for updating a policy- wide property; and means for generating the privacy policy based on 
the policy-wide property. (Column 5, lines 48-55) 

As per claim 16, 

Moriconi et al ('010) discloses the apparatus of claim 12, 
wherein the generation means comprises means for generating a human 
readable version of the policy.(Column 9, lines 45-50 - Examiner notes that although Moriconi 
et al does not specifically disclose "generating a human readable version of the policy" it would 
be obvious that if the policy is manipulated via a GUI it would be readable to the user.) 

As per claim 17 

Moriconi et al ('010) discloses the apparatus of claim 16, 

Official Notice is taken that "hypertext markup language version of the policy" is 
common and well known in prior art in reference to policy management. It would have been 
obvious to one having ordinary skill in the art at the time the invention was made to render the 
policy in HTML format in order to provide a format that is universally viewable across a wide 
variety of computer platforms and operating systems. 

As per claim 18 

Moriconi et al ('010) discloses the apparatus of claim 19, 

Official Notice is taken that "generating an extensible markup language version of the 
policy" is common and well known in prior art in reference to policy management. It would 
have been obvious to one having ordinary skill in the art at the time the invention was made to 
render the policy in XML format in order to provide a format that is universally viewable across 
a wide variety of computer platforms and operating systems. 



As per claim 19, 
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Moriconi et al ( c 010) discloses the apparatus of claim 12, 

wherein the generation means comprises means for generating a compact policy.(Figure 4 
- note element 436 optimizer) 

As per claim 20, 

Moriconi et al ('010) discloses the apparatus of claim 12, 
wherein the generation means comprises means for generating a policy statement corresponding 
to the policy group.(Figure 4) 

As per claim 21 

Moriconi et al ('010) discloses the apparatus of claim 20, 

wherein the generation means further comprises means for generating a table of policy 
elements, wherein a policy element in the table of policy elements corresponds to the policy 
statement.(Column 4, lines 34-37 — the rules [i.e. elements] are stored in a database [i.e. table]) 

As per claim 22, 

Moriconi et al ('010) discloses the apparatus of claim 12, further comprising: means for 
identifying an error in the privacy policy;(Column 11, lines 44-46 - Although Moricini does not 
specifically disclose generating an error statement describing the error he does disclose 
generating a log file, it is well known within modern computing systems to automate the 
generation of error reports from log files) 

As per claim 23, 

Moriconi et al ( 4 010) discloses an interface for creating a privacy policy, comprising: 
a first portion for displaying predefined data elements;(Column 9, lines 45-50) 
a second portion for displaying groups of data elements, wherein a group of data 
elements shares at least one common property;(Figure 4) 

Moriconi et al ('010) does not explicitly disclose a third portion for displaying a privacy 
policy generated from the groups of data elements, Abraham et al. ('987) discloses a third 
portion for displaying a privacy policy generated from the groups of data elements.(Abstract) It 
would have been obvious to one having ordinary skill in the art at the time the invention was 
made to combine the Moriconi et al ('010)'s method with the Abraham et al. ('987)'s method in 
order to secure management of a computer network 

As per claim 24, 

Moriconi et al ('010) discloses a computer program product, in a computer 
readable medium, for creating a privacy policy, comprising: 

instructions for moving a data element to the policy group(Figure 9) 
instructions for generating a privacy policy based on the policy group.(Figure 4) 
Moriconi et al ('010) does not explicitly disclose instructions for creating a policy group, 
Abraham et al. ('987) discloses instructions for creating a policy group.(Abstract) It would have 
been obvious to one having ordinary skill in the art at the time the invention was made to 
combine the Moriconi et al ('010)'s method with the Abraham et al. ('987)'s method in order to 
secure management of a computer network 
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Conclusion 

Examiners note: Examiner has cited particular columns and line numbers in the 
references as applied to the claims above for the convenience of the applicant. Although the 
specified citations are representative of the teachings of the art and are applied to the specific 
limitations within the individual claim, other passages and figures may apply as well. It is 
respectfully requested from the applicant in preparing responses, to fully consider the references 
in entirety as potentially teaching all or part of the claimed invention, as well as the context of 
the passage as taught by the prior art or disclosed by the examiner. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to John M Winter whose telephone number is (703) 305-3971 . The 
examiner can normally be reached on M-F 8:30-6, 1st Fridays off. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, James P Trammell can be reached on (703)305-9768. The fax phone numbers for the 
organization where this application or proceeding is assigned are (703) 305-7687 for regular 
communications and (703) 305-7687 for After Final communications. 

Any inquiry of a general nature or relating to the status of this application or proceeding 
should be directed to the receptionist whose telephone number is (703) 308-1 113. 



JMW 

September 7, 2004 



